1 |
From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001 |
2 |
From: Peter Hutterer <peter.hutterer@who-t.net> |
3 |
Date: Mon, 5 Dec 2022 15:55:54 +1000 |
4 |
Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after |
5 |
freeing it |
6 |
|
7 |
Unlike other elements of the keymap, this pointer was freed but not |
8 |
reset. On a subsequent XkbGetKbdByName request, the server may access |
9 |
already freed memory. |
10 |
|
11 |
CVE-2022-46283, ZDI-CAN-19530 |
12 |
|
13 |
This vulnerability was discovered by: |
14 |
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative |
15 |
|
16 |
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> |
17 |
Acked-by: Olivier Fourdan <ofourdan@redhat.com> |
18 |
--- |
19 |
xkb/xkbUtils.c | 1 + |
20 |
1 file changed, 1 insertion(+) |
21 |
|
22 |
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c |
23 |
index dd089c2046..3f5791a183 100644 |
24 |
--- a/xkb/xkbUtils.c |
25 |
+++ b/xkb/xkbUtils.c |
26 |
@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) |
27 |
} |
28 |
else { |
29 |
free(dst->names->radio_groups); |
30 |
+ dst->names->radio_groups = NULL; |
31 |
} |
32 |
dst->names->num_rg = src->names->num_rg; |
33 |
|
34 |
-- |
35 |
2.38.1 |
36 |
|